summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* unbound: Fix CVE-2024-8508Virendra Thakur2025-03-072-1/+250
| | | | | | | | | | | | Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. Reference: https://nvd.nist.gov/vuln/detail/cve-2024-8508 Signed-off-by: Virendra Thakur <virendrak@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nginx: fix CVE-2025-23419Changqing Li2025-03-032-1/+89
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2025-23419: When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Refer: https://nvd.nist.gov/vuln/detail/CVE-2025-23419 This partially cherry picked from commit 13935cf9fdc3c8d8278c70716417d3b71c36140e, the original patch had 2 parts. One fixed problem in `http/ngx_http_request` module and the second fixed problem in `stream/ngx_stream_ssl_module` module. The fix for `stream/ngx_stream_ssl_module can't be aplied because, the 'stream virtual servers' funcionality was added later in this commit: https://github.com/nginx/nginx/commit/d21675228a0ba8d4331e05c60660228a5d3326de. Therefore only `http/ngx_http_request` part was backported. Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-grpcio(-tools): fix build concurrency issuePeter Marko2025-03-032-0/+8
| | | | | | | | | | | | | | | | | | | Set GRPC_PYTHON_BUILD_EXT_COMPILER_JOBS to limit spawned compiler processes. Without this it uses all available CPUs (via multiprocessing.cpu_count()) and can exhaust build host since there are lot of files to compile (e.g. with 128 cores it manages to spawn 128 gcc processes) Note that this is a general problem for all setuptools based builds with build_ext compilation which can either compile with 1 thread or cpu_count threads. grpcio hot-patches setuptools and allows to set specific build concurrency value. (From master rev: fe582374d3ba474164005942799eb2bddc52a080) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* iperf3: throughput fixTrevor Woerner2025-03-032-0/+31
| | | | | | | | | This is a backport of a fix to iperf3. The author saw a 40% improvement in their network throughput, we've seen around a 55% improvement in our tests. Link: https://github.com/esnet/iperf/pull/1708/commits/ac6b9f7fd335ddebc5212eed40083ef4cd3cb86d Signed-off-by: Trevor Woerner <twoerner@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* abseil-cpp: upgrade 20240116.2 -> 20240116.3Changqing Li2025-03-031-1/+1
| | | | | | | | | | | | | This upgrade include security fix for CVE-2025-0838, refer: https://github.com/abseil/abseil-cpp/releases?page=1 git log: 54fac219 (tag: 20240116.3) Fix potential integer overflow in hash container create/resize (#1812) d7aaad83 (tag: 20240116.2) Abseil LTS Branch, Jan 2024, Patch 2 (#1650) 2f9e432c (tag: 20240116.1) Prepare 20240116.1 patch for Apple Privacy Manifest (#1623) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade 4.2.17 -> 4.2.18Soumya Sambu2025-03-031-2/+2
| | | | | | | | | | Fixes CVE-2024-56374 Release Notes: https://docs.djangoproject.com/en/dev/releases/4.2.18/ Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade 5.0.10 -> 5.0.11Soumya Sambu2025-03-031-1/+1
| | | | | | | | | | Fixes CVE-2024-56374 Release Notes: https://docs.djangoproject.com/en/dev/releases/5.0.11/ Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libeigen: Remove LGPL codePeter Kjellerstedt2025-03-032-2/+1047
| | | | | | | | | | | | | | | Since libeigen is a header-only library, LGPL effectively has the same properties as GPL when it comes to affecting the licensing of the code that uses libeigen. To avoid the problem, backport a patch to remove all LGPL-2.1 code from the library. Also correct the licenses for ${PN}, ${PN}-dbg and ${PN}-dev to reflect that they do not contain any GPL code (the GPL code is only used for benchmark tests and does not affect what is installed). License-Update: Correct the license information Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ebtables: Remove the dependecy on bashPeter Kjellerstedt2025-03-032-12/+9
| | | | | | | Rewrite ebtables-legacy-save to avoid using bashisms. Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* uutils-coreutils: fix compilation with selinuxEtienne Cordonnier2025-03-033-7/+194
| | | | | | | | | | - The scarthgap branch of poky contains Rust 1.75. - uutils-coreutils 0.0.28 requires rust 1.77 when selinux is enabled, even though the project's README.md of release 0.0.28 mistakenly indicates 1.70 as MSRV. This fixes the build of uutils-coreutils 0.0.28 when meta-selinux is included. Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dlt-daemon: make DLT_WatchdogSec configurableChangqing Li2025-03-032-0/+41
| | | | | | | | | | | | On slow system, dlt service may fail since watchdog timeout, backport a patch to make DLT_WatchdogSec configurable, so that this service can start successfully during boot. (cherry-picked from 1cf77003036049533fbda22b96c7fbad1cc693f9) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openjpeg: upgrade 2.5.0 -> 2.5.3Vijay Anusuri2025-03-032-7/+7
| | | | | | | | | | | | Includes fix for CVE-2024-56826 and CVE-2024-56827 ChangeLog: https://github.com/uclouvain/openjpeg/blob/v2.5.3/NEWS.md * Refresh 0002-Do-not-ask-cmake-to-export-binaries-they-don-t-make-.patch Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* source-han-sans-*-fonts: Switch away from SVN fetcher in SRC_URIAlexandre Truong2025-03-034-20/+8
| | | | | | | | | | | | | | | | | | | | | | | | | We get fetch errors from the SRC_URI provided. See errors at [0]. svn protocol was used but it's not supported by github anymore So, an http url will be passed instead. * For the record the svn protocol itself isn't deprecated in bitbake fetcher, just github no longer provides a svn access as mentioned in [1] * github no longer provides support for subversion clients [2] it was shut down on 2024-01-08 [3] * The sha256sum has also been changed since the previous one was for the 1.004 release's archive, while we are on 2.004. [0]: https://autobuilder.yoctoproject.org/typhoon/#/builders/156/builds/353/steps/16/logs/errors [1]: https://git.openembedded.org/bitbake/commit/?h=master&id=a735898abcf056f897c9350bb128a5637e6b4617 [2]: https://docs.github.com/en/enterprise-server@3.11/get-started/working-with-subversion-on-github/support-for-subversion-clients [3]: https://github.blog/2023-01-20-sunsetting-subversion-support/ Signed-off-by: Alexandre Truong <alexandre.truong@smile.fr> Reviewed-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* poco: fix branch: master => poco-1.12.5Chris Laplante2025-03-031-1/+1
| | | | | | | | | | | Upstream renamed branch to 'main', however this commit isn't found on main. Thankfully the poco-1.12.5 branch exists. This patch is not suitable for 'master' on meta-oe because it uses a newer version of poco, which *is* on 'main' branch. Signed-off-by: Chris Laplante <chris.laplante@agilent.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sip: Fix homepage and licenseLeon Anavi2025-03-031-2/+2
| | | | | | | | | | | | | After the migration from Mercurial to GitHub the homepage has changed and SIP has been licensed under the BSD-2-Clause license since Feb 9, 2024, including for release 6.8.6. This work was sponsored by GOVCERT.LU. License-Update: SIP is licensed under the BSD-2-Clause license. Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* modejs: upgrade 20.18.0 -> 20.18.2Archana Polampalli2025-02-041-1/+1
| | | | | | | | | | | | | | | Below list of CVEs are addressed in this release CVE-2025-23083 CVE-2025-23084 CVE-2025-23085 CVE-2025-22150 Changelog: https://github.com/nodejs/node/releases/tag/v20.18.2 https://github.com/nodejs/node/releases/tag/v20.18.1 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: upgrade 20.17.0 -> 20.18.0J. S2025-02-044-3/+3
| | | | | | | | | | | | | | | | License checksum change due to whitespace changes. https://github.com/nodejs/node/commit/1dfd238781 libatomic.patch change due to changes in node.gyp https://github.com/nodejs/node/commit/25c788009f1fa7a392af51cb97d0a55f0f4a6983 Changelog : https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.18.0 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: Fix build with libc++ 19Khem Raj2025-02-042-0/+183
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | As noted in the libc++ 19 release notes [1], std::char_traits<> is now only provided for char, char8_t, char16_t, char32_t and wchar_t, and any instantiation for other types will fail. This causes nodejs-20 to fail to compile with clang 19 and libc++ 19, resulting in errors similar to: /usr/include/c++/v1/string:820:42: error: implicit instantiation of undefined template 'std::char_traits<unsigned short>' 820 | static_assert(is_same<_CharT, typename traits_type::char_type>::value, | ^ ../deps/v8/src/inspector/string-16.h:114:28: note: in instantiation of template class 'std::basic_string<unsigned short>' requested here 114 | std::basic_string<UChar> m_impl; | ^ /usr/include/c++/v1/__fwd/string.h:23:29: note: template is declared here 23 | struct _LIBCPP_TEMPLATE_VIS char_traits; | ^ Upstream v8 has fixed this in commit 182d9c05e78 [2], so add it as a backported patch, until the next version of node is released. [1] https://libcxx.llvm.org/ReleaseNotes/19.html#deprecations-and-removals [2] https://chromium.googlesource.com/v8/v8.git/+/182d9c05e78 Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: upgrade 20.16.0 -> 20.17.0J. S2025-02-043-2/+2
| | | | | | | | | | | | | | | | | | commit c1ddc60fd25456da07d8402c89157c4354fde5ac Author: Jason Schonberg <schonm@gmail.com> Date: Wed Aug 21 17:40:03 2024 -0400 License change - remove highlight.js https://github.com/nodejs/node/commit/1c5fe040a0a73b483cc3e3fef76efe2d1712205b Changelog : https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.17.0 nodejs: upgrade 20.16.0 -> 20.17.0 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: support cross compile without qemu user conditionallyHongxu Jia2025-02-042-41/+124
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Due to the scope of supported BSPs by qemu-user is limited, such as a segment fault on armv9 after qemu apply commit [target/arm: Convert LDAPR/STLR (imm) to decodetree][1] ``` |tmp-glibc/work/neoversen2-crypto-wrs-linux/nodejs/20.5.1/node-v20.5.1/out/ Release/v8-qemu-wrapper.sh: line 7: 3179613 Segmentation fault (core dumped) PSEUDO_UNLOAD=1 qemu-aarch64 -r 5.15 -L tmp-glibc/work/neoversen2-crypto-wrs-linux/ nodejs/20.5.1/recipe-sysroot -E LD_LIBRARY_PATH=tmp-glibc/work/neoversen2-crypto-wrs-linux/ nodejs/20.5.1/recipe-sysroot/usr/lib64:tmp-glibc/work/neoversen2-crypto-wrs-linux/ nodejs/20.5.1/recipe-sysroot/usr/lib64 "$@" ``` Upstream nodejs have cross compile support, but it needs host and target have same bit width (e.g. a x86_64 host targeting arrch64 to produce a 64-bit binary). So: 1. If host and target have different bit width, build with QEMU user as usual; 2. If host and target have same bit width, enable notejs cross compile support: - The build tools of nodejs is GYP[2], set CC_host, CFLAGS_host, CXX_host, CXXFLAGS_host, LDFLAGS_host, AR_host for host build which is separated with target build [3] - Satisfy layer compatibility, set GYP variables in prefuncs of do_configure, do_compile and do_install other than in recipe parsing - Add missing native packages to fix library missing on host build - Rework libatomic.patch, explicitly link to libatomic for clang conditionally [1] https://github.com/qemu/qemu/commit/2521b6073b7b4b505533a941d4f9600f7585dc78 [2] https://github.com/nodejs/node-gyp [3] https://github.com/nodejs/node-gyp/blob/main/gyp/docs/UserDocumentation.md#cross-compiling Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: upgrade 20.13.0 -> 20.16.0Jason Schonberg2025-02-043-1/+1
| | | | | | | Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: Upgrade to 20.13.0 releaseKhem Raj2025-02-043-2/+2
| | | | | | | | | | | | | nodejs release notes [1] License-Update: Copyright year changed for Unicode License [2] [1] https://nodejs.org/en/blog/release/v20.13.0 [2] https://github.com/nodejs/node/commit/d5a316f5ea3fade3140c2ae35c144b500fb5d758 Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nginx: fix the tarball and license checksumsJef Driesen2025-02-041-2/+2
| | | | | | | | | The nginx upgrade in commit 6eef5e3efb0a871622d2ea5eeb016b61d46f722c added an incorrect tarball checksum and didn't update the license checksum, resulting in build failures. Signed-off-by: Jef Driesen <jefdriesen@telenet.be> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* uutils-coreutils: upgrade 0.0.27 -> 0.0.28Wang Mingyu2025-02-042-195/+475
| | | | | | | | | | Changelog: https://github.com/uutils/coreutils/releases/tag/0.0.28 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: upgrade 7.2.6 -> 7.2.7Divya Chellam2025-02-0410-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | ChangeLog: https://github.com/redis/redis/releases/tag/7.2.7 Upgrade urgency SECURITY: See security fixes below. Security fixes ==================== * (CVE-2024-46981) Lua script commands may lead to remote code execution * (CVE-2024-51741) Denial-of-service due to malformed ACL selectors Bug fixes ==================== * #13380 Possible crash due to OOM panic on invalid command * #13338 Streams: XINFO lag field is wrong when tombstone is after the last_id of the consume group * #13473 Streams: XTRIM does not update the maximal tombstone, leading to an incorrect lag * #13311 Cluster: crash due to unblocking client during slot migration * #13443 Cluster: crash when loading cluster config * #13422 Cluster: CLUSTER SHARDS returns empty array * #13465 Cluster: incompatibility with older node versions Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* lapack: fix buildpaths in ptest also when CBLAS is enabledMartin Jansa2025-02-041-6/+17
| | | | | | | | | | | | | | | | | | | ERROR: lapack-3.12.0-r0 do_package_qa: QA Issue: File /usr/lib/lapack/ptest/bin/xccblat3 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xdcblat3 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xdcblat1 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xscblat1 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xccblat2 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xzcblat2 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xzcblat1 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xccblat1 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xdcblat2 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xscblat2 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xscblat3 in package lapack-ptest contains reference to TMPDIR File /usr/lib/lapack/ptest/bin/xzcblat3 in package lapack-ptest contains reference to TMPDIR [buildpaths] Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* lapack: add PACKAGECONFIG for cblasMartin Jansa2025-02-041-0/+1
| | | | | Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* lapack: fix TMPDIR reference in do_package_qaZhang Peng2025-02-041-0/+31
| | | | | | | | | | | | | | | | | | | | | | | When building the `lapack` package, the following QA error occurs: "File /usr/lib64/libblas.so.3.12.0 in package lapack contains reference to TMPDIR [buildpaths]" The issue arises because the `xerbla.o` object file embeds the absolute host path of `xerbla.f`. This occurs during compilation, where the build command in `build.make` (generated by CMake) specifies: `gfortran -c <absolute path>/xerbla.f -o`. As a result, the absolute path is included in `xerbla.o`. Unfortunately, `gfortran` does not support flags like `-fdebug-prefix-map` or `-ffile-prefix-map` to remove such paths. To resolve this, the fix involves replacing the absolute path of `xerbla.f` in the generated `build.make` file with a relative path before the compilation step. This ensures that the resulting `xerbla.o` does not contain any references to TMPDIR, passing the `do_package_qa` check. For ptest code, the solution is to replace `${WORKDIR}` with `../../..` in the generated `build.make` files located in the TESTING directory. Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-grpcio: patch CVE-2024-11407Peter Marko2025-02-042-0/+33
| | | | | | | | | | Cherry-pick commit [1] mentioned in [2]. [1] https://github.com/grpc/grpc/commit/e9046b2bbebc0cb7f5dc42008f807f6c7e98e791 [2] https://nvd.nist.gov/vuln/detail/CVE-2024-11407 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* mdio-tools: fix mdio-netlink kernel module reproducibilityYoann Congal2025-02-042-4/+3
| | | | | | | | | | | | | | | | | | mdio-netlink source make reference to ${S}/.. which breaks -fdebug-prefix-map and results in the full TMPDIR path being present in the -dbg package and, also, change a related CRC in the main package. This changes ${S} to enclose the whole SRC_URI repo and adapt relative paths to build (MODULES_MODULE_SYMVERS_LOCATION) This make mdio-netlink reproducible and fixes this warning: WARNING: mdio-netlink-1.3.1-r0 do_package_qa: QA Issue: File /lib/modules/6.6.29-yocto-standard/updates/.debug/mdio-netlink.ko in package mdio-netlink-dbg contains reference to TMPDIR [buildpaths] Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Reviewed-by: Alexandre Truong <alexandre.truong@smile.fr> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d161de0b00b91cd0c286fbbc1190f87cf20fe088) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* poppler: fix CVE-2024-56378Yogita Urade2025-02-042-0/+78
| | | | | | | | | | | | | | | libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-56378 Upstream patch: https://gitlab.freedesktop.org/poppler/poppler/-/commit/ade9b5ebed44b0c15522c27669ef6cdf93eff84e Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libcamera: backport 0.4.0 from master-nextThomas Roos2025-02-044-248/+5
| | | | | | | | | | | | | | This is done because libcamera 0.2. is broken, probablay because of 0001-rpi-Use-alloca-instead-of-variable-length-arrays.patch Tested good with upstream version. See more details here: https://github.com/openembedded/meta-openembedded/issues/919 and here: https://github.com/raspberrypi/rpicam-apps/issues/654 Signed-off-by: Thomas Roos <throos@amazon.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* gphoto2: Fix contains reference to TMPDIR [buildpaths] warningHieu Van Nguyen2025-01-201-0/+3
| | | | | | | | Remove ${RECIPE_SYSROOT} path from ${B}/config.h to fix the QA warning: WARNING: gphoto2-2.5.28-r0 do_package_qa: QA Issue: File /usr/bin/gphoto2 in package gphoto2 contains reference to TMPDIR [buildpaths] Signed-off-by: Hieu Van Nguyen <hieu2.nguyen@lge.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* crash: fix crash cannot work with kaslrXiangyu Chen2025-01-202-0/+90
| | | | | | | | | According to crash help message, crash can decode the random address with "--kaslr=auto". But it has a bug that when with "-S" in parameter, crash will bypass the kaslr option. Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* hostapd: Add CVE id to CVE-2024-3596_00.patchRobert Yang2025-01-201-0/+1
| | | | | Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* grpc: patch CVE-2024-11407Peter Marko2025-01-202-0/+33
| | | | | | | | | | Cherry-pick commit [1] mentioned in [2]. [1] https://github.com/grpc/grpc/commit/e9046b2bbebc0cb7f5dc42008f807f6c7e98e791 [2] https://nvd.nist.gov/vuln/detail/CVE-2024-11407 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* opensc: fix CVE-2024-8443Zhang Peng2025-01-203-0/+117
| | | | | | | | | | | | | | | | | | | | | CVE-2024-8443: The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘themehunk_megamenu_bg_image' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note that this was partially fixed in 1.1.0 due to the missing authorization protection that was added. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-8433] Upstream patches: [https://github.com/OpenSC/OpenSC/commit/02e847458369c08421fd2d5e9a16a5f272c2de9e] [https://github.com/OpenSC/OpenSC/commit/b28a3cef416fcfb92fbb9ea7fd3c71df52c6c9fc] Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* glade: fix CVE-2020-36774Zhang Peng2025-01-202-0/+55
| | | | | | | | | | | | | | | | CVE-2020-36774: plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to a denial of service (application crash). Reference: [https://nvd.nist.gov/vuln/detail/CVE-2020-36774] Upstream patches: [https://gitlab.gnome.org/GNOME/glade/-/commit/7acdd3c6f6934f47b8974ebc2190a59ea5d2ed17] Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ptest-packagelists-meta-oe.inc: Add asioMingli Yu2025-01-201-0/+1
| | | | | | Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* asio: Add ptest supportMingli Yu2025-01-203-2/+73
| | | | | | | | | | | | | | | | | | | | | | | | | | | | # ./run-ptest PASS: address PASS: address_v4 PASS: address_v4_iterator PASS: address_v4_range PASS: address_v6 PASS: address_v6_iterator PASS: address_v6_range PASS: any_completion_executor PASS: any_completion_handler PASS: any_executor PASS: any_io_executor PASS: append PASS: as_tuple PASS: associated_allocator PASS: associated_cancellation_slot PASS: associated_executor PASS: associated_immediate_executor PASS: associator PASS: async_result [snip] Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nginx: upgrade 1.25.3 -> 1.25.4Divya Chellam2025-01-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: =========== https://nginx.org/en/CHANGES *) Security: when using HTTP/3 a segmentation fault might occur in a worker process while processing a specially crafted QUIC session (CVE-2024-24989, CVE-2024-24990). *) Bugfix: connections with pending AIO operations might be closed prematurely during graceful shutdown of old worker processes. *) Bugfix: socket leak alerts no longer logged when fast shutdown was requested after graceful shutdown of old worker processes. *) Bugfix: a socket descriptor error, a socket leak, or a segmentation fault in a worker process (for SSL proxying) might occur if AIO was used in a subrequest. *) Bugfix: a segmentation fault might occur in a worker process if SSL proxying was used along with the "image_filter" directive and errors with code 415 were redirected with the "error_page" directive. *) Bugfixes and improvements in HTTP/3. Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* pipewire: upgrade 1.0.5 -> 1.0.9gudnimar2025-01-201-1/+1
| | | | | | | | | | | Bug fix releases which are API and ABI compatible with previous 1.0.x releases. Changelog can be found here: https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/1.0.9/NEWS?ref_type=tags Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* thrift: fix c++ generated code compilation with clangPeter Marko2025-01-202-1/+602
| | | | | | | | | Backport PR merged to thrift v0.21.0 to be able to compile thrift generated c++ code with C++20 clang 15+. Signed-off-by: Stanislav Angelovic <stanislav.angelovic.ext@siemens.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* bpftool: fix libelf.h not found errorPreeti Sachan2025-01-201-1/+1
| | | | | | | | | | | | | When build host machine is not installed with elfutils-libelf-devel, it throws compile error "libelf.h: No such file or directory". Fix missing headers file by including path ${STAGING_INCDIR_NATIVE} via CFLAGS variable. Use headers file from ${STAGING_INCDIR_NATIVE} instead of host machine. Error: | libbpf_internal.h:19:10: fatal error: libelf.h: No such file or directory Signed-off-by: Preeti Sachan <preeti.sachan@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade 5.0.9 -> 5.0.10Soumya Sambu2025-01-201-1/+1
| | | | | | | | | | Fixes CVE-2024-53907 and CVE-2024-53908 Release Notes: https://docs.djangoproject.com/en/dev/releases/5.0.10/ Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade 4.2.16 -> 4.2.17Soumya Sambu2025-01-201-2/+2
| | | | | | | | | | Fixes CVE-2024-53907 and CVE-2024-53908 Release Notes: https://docs.djangoproject.com/en/dev/releases/4.2.17/ Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* wireshark 4.2.7: Fix CVE-2024-9781Shubham Pushpkar2025-01-202-0/+134
| | | | | | | | | | | | | Upstream Repository: https://gitlab.com/wireshark/wireshark.git Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2024-9781 Type: Security Fix CVE: CVE-2024-9781 Score: 7.8 Patch: https://gitlab.com/wireshark/wireshark/-/commit/cad248ce3bf5 Signed-off-by: Shubham Pushpkar <spushpka@cisco.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* php: upgrade 8.2.24 -> 8.2.26Vijay Anusuri2025-01-201-1/+1
| | | | | | | | | | Includes fix for CVE-2024-8929, CVE-2024-11236, CVE-2024-11234 and CVE-2024-11233 Changelog: https://www.php.net/ChangeLog-8.php#8.2.26 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* chrony: fix do_fetch errorJiaying Song2025-01-201-1/+1
| | | | | | | | Change the SRC_URI to the correct value due to the following error: WARNING: chrony-4.5-r0.wr2401 do_fetch: Failed to fetch URL https://download.tuxfamily.org/chrony/chrony-4.5.tar.gz, attempting MIRRORS if available Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ghex,gnome-chess,gnome-photos: Add missing dep on itstool-nativeKhem Raj2025-01-053-1/+3
| | | | | | | | Fixes build issues in these recipe in meta-gnome Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit af6858aa3729a81780f2ec113c095f7f0c87c226) Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-04 20:55:03 +0000